@@ -18,7 +18,7 @@ the data at rest and in transit via TLS encryption.
18
18
appropriately set.
19
19
20
20
** Audit:**
21
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep etcd ```
21
+ ``` kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep etcd ```
22
22
23
23
** Expected Result:**
24
24
```
@@ -45,7 +45,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
45
45
** Remediation:** Run the audit command mentioned below to verify that ` --client-cert-auth ` is set to ` true ` .
46
46
47
47
** Audit:**
48
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep etcd ```
48
+ ``` kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep etcd ```
49
49
50
50
** Expected Result:**
51
51
```
@@ -72,7 +72,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
72
72
** Remediation:** Run the audit command mentioned below to verify that ` --auto-tls ` argument does not exist.
73
73
74
74
** Audit:**
75
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep etcd ```
75
+ ``` kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep etcd ```
76
76
77
77
** Expected Result:**
78
78
```
@@ -100,7 +100,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
100
100
appropriately set .
101
101
102
102
** Audit:**
103
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep etcd ```
103
+ ``` kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep etcd ```
104
104
105
105
** Expected Result:**
106
106
```
@@ -127,7 +127,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
127
127
** Remediation:** Run the audit command mentioned below to verify that ` --peer-client-cert-auth ` is set to ` true ` .
128
128
129
129
** Audit:**
130
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep etcd ```
130
+ ``` kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep etcd ```
131
131
132
132
** Expected Result:**
133
133
```
@@ -154,7 +154,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
154
154
** Remediation:** Run the audit command mentioned below to verify that ` --peer-auto-tls ` argument does not exist.
155
155
156
156
** Audit:**
157
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep etcd ```
157
+ ``` kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep etcd ```
158
158
159
159
** Expected Result:**
160
160
```
@@ -174,7 +174,9 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
174
174
https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-cluster
175
175
```
176
176
177
+ <!-- vale Google.Headings = NO -->
177
178
## 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)
179
+ <!-- vale Google.Headings = YES -->
178
180
179
181
**Result:** PASS
180
182
@@ -183,7 +185,7 @@ for api-server is different from the --trusted-ca-file used by etcd.
183
185
184
186
**Audit:**
185
187
Run the following command and note the file referenced by ' --trusted-ca-file'
186
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep etcd ```
188
+ ```kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep etcd```
187
189
188
190
**Returned Value:**
189
191
```bash
@@ -199,7 +201,7 @@ https://emb-0.emb-headless.emb:2380 --initial-cluster-state=new --force-new-clus
199
201
```
200
202
201
203
Now run the following command and note the file referenced by ' --client-ca-file'
202
- ``` kubectl exec -n <vCluster -namespace> <vCluster -pod-name> -- ps -ef | grep apiserver ```
204
+ ```kubectl exec -n <vcluster -namespace> <vcluster -pod-name> -- ps -ef | grep apiserver```
203
205
204
206
**Returned Value:**
205
207
```bash
0 commit comments